Dnsmasq messing my /etc/resolv.conf

Hello,

I have setup dnsmasq to provide dhcp address to two interfaces. This is working fine. However, dnsmasq also modifies my /etc/resolv.conf which i dont want. I dont want dnsmasq to touch that file at all. How do i do that?

Here is my config,

services.dnsmasq.enable = true;    
services.dnsmasq.settings = {
interface=["vlan80br" "vlan90br"];
except-interface="lo";
bind-interfaces= true;
dhcp-range=["192.168.11.3,192.168.11.5,12h" "192.168.12.3,192.168.12.5,12h"];
};

This generates the file,

# cat /nix/store/0k8hbnk69cyxy4np6iax3cxxwpb8wvpp-dnsmasq.conf
bind-interfaces
conf-file=/etc/dnsmasq-conf.conf
dhcp-leasefile=/var/lib/dnsmasq/dnsmasq.leases
dhcp-range=192.168.11.3,192.168.11.5,12h
dhcp-range=192.168.12.3,192.168.12.5,12h
except-interface=lo
interface=vlan80br
interface=vlan90br
resolv-file=/etc/dnsmasq-resolv.conf

The file doesnt reference /etc/resolv.conf nonetheless i see that /etc/resolv.conf gets set to 127.0.0.1 while i want it to point to 172.17.1.1

I have set the networking as follows,

  networking = {
    dhcpcd.enable = false;
    useDHCP = false;
    useHostResolvConf = false;
    nameservers = [ "172.17.1.1" ];
    search = ["localdomain"];
  };    

services.resolved = { 
  enable = false;
  dnssec = "true"; 
  domains = [ "localdomain" ];
  fallbackDns = [ "172.17.1.1"  "1.1.1.1#one.one.one.one" "1.0.0.1#one.one.one.one" ];
  dnsovertls = "true";
};

What change do i need to do so that /etc/resolv.conf always points to 172.17.1.1?

Set networking.resolvconf.useLocalResolver = false.

Thanks. I add that to the configuration,

  networking = {
    dhcpcd.enable = false;
    useDHCP = false;
    useHostResolvConf = false;
    nameservers = [ "172.17.1.1" ];
    search = ["lan"];
    resolvconf.useLocalResolver = false;
  };

Unfortunately, after the rebuild it still changed the resolv.conf to

$ cat /etc/resolv.conf
# Generated by resolvconf
search lan
nameserver 127.0.0.1
options edns0

It looks like that entry is generated at runtime by something calling resolvconf. Try running tail /run/resolvconf/interfaces/* to confirm.

I get this

tail /run/resolvconf/interfaces/*

search lan
nameserver 172.17.1.1
nameserver 127.0.0.1

Uhm, so there’s a single file. /run/resolvconf/interfaces/static ?

Yes a single file. Should there be anything else?

Why does it have 127.0.0.1 address?

I ended up hardcoding like this,

 networking = {
    dhcpcd.enable = false;
    useDHCP = false;
    useHostResolvConf = false;
    nameservers = [ "172.17.1.1" ];
    search = ["lan"];
    resolvconf.useLocalResolver = false;
  };

services.dnsmasq.enable = true;
services.dnsmasq.settings = {
interface=["vlan80br" "vlan90br"];
except-interface="lo";
bind-interfaces= true;
dhcp-range=["192.168.11.3,192.168.11.5,12h" "192.168.12.3,192.168.12.5,12h"];


environment.etc = {
    "resolv.conf".text = "search lan\nnameserver 172.17.1.1\n";
  };

This removed resolvconf itself during nixos switch,

removing group ‘resolvconf’
setting up /etc...

It the entry is in static there must be some other NixOS module that’s setting it. I’ve built a VM with your configuration:

{
  users.users.root.password = "root";

  networking = {
    dhcpcd.enable = false;
    useDHCP = false;
    useHostResolvConf = false;
    nameservers = [ "172.17.1.1" ];
    search = ["localdomain"];
  };    

  services.resolved = { 
    enable = false;
    dnssec = "true"; 
    domains = [ "localdomain" ];
    fallbackDns = [ "172.17.1.1"  "1.1.1.1#one.one.one.one" "1.0.0.1#one.one.one.one" ];
    dnsovertls = "true";
  };

}

and I don’t get the 127.0.0.1 entry. So, it’s something else that you did not post.

Here is the full file,

$ cat networking.nix
{ config, pkgs, ... }:
{

  # REGION Networking

  networking = {
    dhcpcd.enable = false;
    useDHCP = false;
    useHostResolvConf = false;
    nameservers = [ "172.17.1.1" ]; 
    search = ["lan"];
    resolvconf.useLocalResolver = false;
  };

    environment.etc = {
    "resolv.conf".text = "search lan\nnameserver 172.17.1.1\n";
  };

services.resolved = {
  enable = false;
  dnssec = "true";
  #domains = [ "~." ];
  domains = [ "localdomain" ];
  fallbackDns = [ "172.17.1.1"  "1.1.1.1#one.one.one.one" "1.0.0.1#one.one.one.one" ];
  dnsovertls = "true";
};
  networking.firewall.enable = true;
  networking.nftables.enable = true;
  networking.nftables.flushRuleset = false;
  networking.firewall.trustedInterfaces = [
    "vlan20br"
    "vlan30br"
    "vlan40br"
    "vlan50br"
    "vlan80br"
    "vlan90br"
  ];
  networking.firewall.checkReversePath = "loose";
  networking.firewall.logReversePathDrops = true;



  systemd.network = {
    enable=true;
    netdevs = {

      "10-bond0" = {
        netdevConfig = {
          Kind = "bond";
          Name = "bond0";
        };
        bondConfig = {
          Mode = "802.3ad";
          TransmitHashPolicy = "layer3+4";
        };
      };

#create the vlan interfaces
      "1-vlan20" = {
        netdevConfig = {
          Kind = "vlan";
          Name = "vlan20";
        };
        vlanConfig.Id = 20;
      };

      "1-vlan30" = {
        netdevConfig = {
          Kind = "vlan";
          Name = "vlan30";
        };
        vlanConfig.Id = 30;
      };
      "1-vlan40" = {
        netdevConfig = {
          Kind = "vlan";
          Name = "vlan40";
        };
        vlanConfig.Id = 40;
      };
      "1-vlan50" = {
        netdevConfig = {
          Kind = "vlan";
          Name = "vlan50";
        };
        vlanConfig.Id = 50;
      };
      "1-vlan80" = {
        netdevConfig = {
          Kind = "vlan";
          Name = "vlan80";
        };
        vlanConfig.Id = 80;
      };
      "1-vlan90" = {
        netdevConfig = {
          Kind = "vlan";
          Name = "vlan90";
        };
        vlanConfig.Id = 90;
      };


       # Create the bridge interfaces
       "vlan20br" = {
         netdevConfig = {
           Kind = "bridge";
           Name = "vlan20br";
         };
       };

       "vlan30br" = {
         netdevConfig = {
           Kind = "bridge";
           Name = "vlan30br";
         };
       };
       "vlan40br" = {
         netdevConfig = {
           Kind = "bridge";
           Name = "vlan40br";
         };
       };
       "vlan50br" = {
         netdevConfig = {
           Kind = "bridge";
           Name = "vlan50br";
         };
       };
       "vlan80br" = {
         netdevConfig = {
           Kind = "bridge";
           Name = "vlan80br";
         };
       };
       "vlan90br" = {
         netdevConfig = {
           Kind = "bridge";
           Name = "vlan90br";
         };
       };
    };
    networks = {
      "10-ens3f0" = {
        matchConfig.Name = "ens3f0";
        networkConfig.Bond = "bond0";
      };

      "10-ens3f1" = {
        matchConfig.Name = "ens3f1";
        networkConfig.Bond = "bond0";
      };


      "10-bond0" = {
        matchConfig.Name = "bond0";
        # tag vlan on this link
        vlan = [
          "vlan10"
          "vlan20"
          "vlan30"
          "vlan40"
          "vlan50"
          "vlan80"
          "vlan90"
        ];
        networkConfig.LinkLocalAddressing = "no";
        linkConfig.RequiredForOnline = "carrier";
      };

      # Connect the bridge ports to the bridge
      "vlan2" = {
        matchConfig.Name = "vlan20";
        networkConfig.Bridge = "vlan20br";
      };
      "vlan30" = {
        matchConfig.Name = "vlan30";
        networkConfig.Bridge = "vlan30br";
      };
      "vlan40" = {
        matchConfig.Name = "vlan40";
        networkConfig.Bridge = "vlan40br";
      };
      "vlan50" = {
        matchConfig.Name = "vlan50";
        networkConfig.Bridge = "vlan50br";
      };
      "vlan80" = {
        matchConfig.Name = "vlan80";
        networkConfig.Bridge = "vlan80br";
      };
      "vlan90" = {
        matchConfig.Name = "vlan90";
        networkConfig.Bridge = "vlan90br";
      };


      # Connect the bridge ports to the bridge
      "2-vlan20br" = {
        matchConfig.Name = "vlan20br";
        address = [
        "172.17.1.137/24"
        ];
    routes = [
      { Gateway = "172.17.1.1"; }
    ];
# make the routes on this interface a dependency for network-online.target
        linkConfig.RequiredForOnline = "routable";
      };
      #GUEST
      "2-vlan30br" = {
        matchConfig.Name = "vlan30br";
        address = [
        "192.168.30.29/24"
        ];
      };
      #NOINTERNET
      "2-vlan40br" = {
        matchConfig.Name = "vlan40br";
        address = [
        "192.168.40.52/24"
        ];
      };
      #DMZ
      "2-vlan50br" = {
        matchConfig.Name = "vlan50br";
        address = [
        "192.168.50.30/24"
        ];
      };

      "2-vlan80br" = {
        matchConfig.Name = "vlan80br";
        address = [
        "192.168.11.1/24"
        ];
    routes = [
      { Destination = "239.255.42.42/32"; }
       ];
      };
      "2-vlan90br" = {
        matchConfig.Name = "vlan90br";
        address = [
        "192.168.12.1/24"
        ];
    routes = [
      { Destination = "239.255.42.43/32"; }
    ];
      };




    };
  };

services.dnsmasq.enable = true;
services.dnsmasq.settings = {
interface=["vlan80br" "vlan90br"];
except-interface="lo";
bind-interfaces= true;
dhcp-range=["192.168.11.3,192.168.11.5,12h" "192.168.12.3,192.168.12.5,12h"];
};
systemd.services.dnsmasq.requires = ["network-online.target"];
systemd.services.dnsmasq.after = ["network-online.target"];
systemd.services.dnsmasq.before = ["incus.service"];



  # ENDREGION
}

Ok, it took me a while but I found it. Set

services.dnsmasq.resolveLocalQueries = false;

1 Like

This was it. Thank you very much!

1 Like